n8n's Oracle Database node contains an SQL injection vulnerability in the 'Limit' field when user-controlled input is passed via expressions without proper sanitization. This flaw allows attackers to inject arbitrary SQL commands, potentially leading to data exfiltration from the connected Oracle database. The vulnerability requires specific workflow configurations where external input reaches the 'Limit' field. It has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting workflow editing permissions, disabling the Oracle Database node, and avoiding unvalidated input in the 'Limit' field.